How Tracefox handles your data
When you put a monitoring tool on client sites, the first question your client's IT team asks is where does the data live. This page covers what Tracefox does on a site, what it stores, who can see it, and when it is deleted.
Nothing to install
Tracefox works from the outside, in a headless browser, like a visitor. It needs no plugin, theme change, admin login or database access on the store. Site scans only read pages; checkout tests click and type, as described below.
Private media storage
Scan snapshots, screenshots and test videos are stored in S3-compatible object storage. Files have no public links: the app serves them only to signed-in members of the workspace that owns them.
Encrypted in transit
The dashboard and API are served over HTTPS, plain HTTP requests are redirected to HTTPS, and HSTS tells browsers to use HTTPS only. Stored media is fetched from object storage by our servers, never linked publicly.
Credential hygiene
Account passwords are hashed with bcrypt (cost factor 10). API keys are stored only as SHA-256 hashes, so we can't show a key again after you create it. Session cookies are HttpOnly, Secure, and SameSite=Lax.
Site scans: read only
A site scan loads the page you add, plus up to three links on the same site to check for errors, and records what a regular browser receives. It does not sign in, fill in forms or click through the checkout.
What a scan records
- ✓Page HTML and the scripts it loads
- ✓Third-party scripts and their domains
- ✓Cookies the page sets: name, domain, path and expiry, not their values
- ✓Network requests fired by the page
- ✓Status codes of up to three same-site links
- ✓Policy pages you list, if you add them
- ✓A screenshot of the page
What a scan does not do
- ✗Sign in or open pages behind a login
- ✗Fill in or submit forms
- ✗Record cookie values or visitors' personal data
- ✗Record keystrokes, mouse movement or sessions
- ✗Follow links to other domains
Checkout tests: they act on the live store
A checkout test does what a shopper does: it opens pages, clicks, selects options, types into fields and applies discount codes, using the steps and test data you set up. It stops where you tell it to, usually before payment. If you build a test that completes an order, that order is real: it shows up in the store and can change inventory, send emails, reach fulfillment apps and count in analytics.
What a test stores: its steps and the values typed into ordinary fields, the test data you enter (name, address, email, phone), a screenshot after each step, a video of each run on plans that include video, step timings and error messages. Ordinary values and test data are stored as plain text and are visible to everyone in your workspace.
Password fields, and any field you mark as sensitive, are handled differently. The value is encrypted (AES-256-GCM) with a key kept outside the database, and the test's steps store only a reference to it. After saving, nobody can view it, you included; the workspace owner and Admins can replace it. Only the test runner decrypts it, for the run that uses it, and it is removed from stored error messages, alerts and our logs. While you record, what you type passes through our servers so it can be saved this way.
Screenshots cover password fields and the fields filled from a sensitive value; a value the store shows somewhere else on the page is not covered. Runs that enter a sensitive value or fill a password field record no video, because a continuous recording can't be masked reliably. Tests saved before 20 October 2026 may still hold passwords in plain text until they are migrated, and older screenshots, videos and error messages are unchanged, so change any password you used in a test before then.
Still use a dedicated test account, never a real customer or admin login. We do not ask for real card numbers, and card fields can't be marked sensitive: use made-up details and your payment provider's test cards only on a store in test mode.
Retention and deletion
- Run history, step screenshots, run videos and scan snapshots are deleted once they are older than your plan's history window (7 days on Free, up to 90 days on Business). A daily job removes both the records and the stored files.
- Deleting a test or a website removes its runs or scans and their stored files at the same time.
- Tests, their steps and test data are kept until you delete them. To delete your whole account, email support@tracefox.co.
Compliance & certifications
GDPR practices
DPA available on request, right-to-erasure honored within 30 days, and a published Privacy Policy describing data flows. This describes how we operate; it is not a certification or a legal opinion.
Cookie Consent Mode v2
Our own site uses Google Consent Mode v2 with analytics_storage denied by default. Marketing tags only fire after explicit opt-in.
SOC 2
Tracefox does not hold a SOC 2 report or any other security certification. For a vendor security questionnaire, email security@tracefox.co.
Subprocessors
Railway (hosting, Postgres database, and BullMQ + Redis background jobs), an S3-compatible object storage provider (scan and test media), Resend (email), Stripe (payments), and PostHog (product analytics). The full list and DPAs are available on request.
If something goes wrong
If we confirm a security incident that affects your data, we email the account owner with what happened, which data was involved and what we are doing about it.
Security-sensitive reports (vulnerabilities, suspected account compromise) go to security@tracefox.co. We aim to reply within one business day.
Need a DPA, subprocessor list, or to run Tracefox through your vendor security review?
Contact security team